Event Monitoring and Field Audit Trail for regulatory oversight
Key Takeaway
Event Monitoring records what users did, such as API calls and report exports. Field Audit Trail keeps a long-term history of field value changes, so evidence of both kinds needs both tools. For Field Audit Trail, turn on Field History Tracking first, then deploy a retention policy.
Event Monitoring and Field Audit Trail let financial firms prove who did what in their Salesforce org. Event Monitoring records user activity, such as logins, API calls, and report exports. Field Audit Trail keeps a long-term history of changes to field values on records. Because they record different evidence, one tool can't replace the other.
Two tools for two audit questions
Shield is fully supported in Agentforce Financial Services. Shield is an add-on product, so a customer gets it by talking to their Salesforce Account Executive.
The two tools answer different audit questions. Event Monitoring shows what users did in the org, such as logging in or exporting a report. Field Audit Trail shows how field values on records changed over time. A firm that must show both user activity and several years of field changes needs both tools.
A wealth management firm's security team notices odd activity from a service user, Tomás. Event Monitoring shows that on Tuesday he logged in from several IP addresses he had never used before. Event Monitoring also shows a burst of API calls from his account. The team then asks whether Tomás ever changed client data. The firm tracks the Credit Limit field on accounts and archives its history with Field Audit Trail. The archive shows that 26 months ago Tomás changed one client's Credit Limit, with the old value and the date. Event Monitoring answered the activity question, and Field Audit Trail answered the field change question.